Privacy Notice

Draft · demo only

Who operates Ratiomerx

Ratiomerx is operated by Not configured; demo service only at Not configured; demo service only ("Ratiomerx", "we", or "us"). Privacy questions or requests can be sent to Not configured; demo service only.

Information the service handles

Account email address, authentication identifiers, and account security events.
Business workspace details and the product, stock, sales, cost, payout, and expense records you enter or import.
Plan and subscription status processed by Stripe if billing is enabled. Card numbers are entered on Stripe-hosted pages and are not sent to or stored by Ratiomerx.
Support or other information you choose to send us.

The current implementation stores account workspaces in a Supabase Postgres database in Not configured; demo service only. Supabase Auth manages sign-in. Stripe Checkout and Billing handle payment details when configured. Provider processing terms and the configured retention settings apply.

Why information is used

Information is used to create and secure accounts, save and display the workspace you request, calculate business summaries, provide backups and account deletion, manage subscriptions, and respond to support or security issues. Ratiomerx does not need your records to calculate the figures locally in your signed-in session, but the saved workspace is sent to the configured database so it can sync across sign-ins.

Access controls and service providers

Workspace rows are protected by database row-level security policies tied to the authenticated account. The browser uses a public Supabase key; private service-role keys, OAuth secrets, and Stripe secrets belong only in server-side Supabase Function secrets. Stripe receives billing information needed to provide Checkout and subscription services. If Google Sheets is enabled, you grant read-only access to your Google spreadsheets; its refresh token is encrypted before being stored by Ratiomerx. TikTok Shop and Shopee tokens are not collected by this implementation.

Internet services cannot be guaranteed perfectly secure. Do not enter passwords, payment card numbers, government identifiers, or information that is not needed to manage your shop.

Retention, export, and deletion

You can export workspace records from Settings & Data. Keep that file somewhere you control. If the daily encrypted backup service is configured and running, app-managed recovery points are retained for up to 30 days and can be restored from the app. You can request account deletion in the app. The deletion function cancels a recorded Stripe subscription, removes saved Ratiomerx integration credentials and app-managed backup objects, and removes the authentication account; database foreign-key rules then remove its primary workspace and subscription rows. If subscription cancellation or backup removal fails, deletion stops so you can retry rather than silently abandon an active subscription or leave a known backup behind. Google may retain an OAuth grant if its revocation endpoint is unavailable; in that case, revoke Ratiomerx in your Google Account settings too.

Stripe may retain customer, invoice, and transaction records under its own retention rules and applicable law, even after Ratiomerx cancels a subscription and removes its local account records. Primary database deletion does not instantly remove copies that may exist in infrastructure backups, logs, or other provider systems. Their retention depends on the configured provider plan and settings and must be confirmed by the service operator before launch. These provider copies are separate from the 30-day app-managed recovery points described above.

Browser storage and demo

The public demo uses illustrative sample records. A short-lived browser session stores the sign-in tokens needed to call the authenticated API. Signing out removes that session from the current browser. Closing the browser session may require signing in again.

Your choices and rights

You may sign out, export your workspace, and request deletion using the account controls. Additional access, correction, objection, or other privacy rights depend on the applicable law and should be directed to the completed privacy contact above. The operator must confirm and publish the applicable rights process and response timeline before launch.

Changes and contact

We will update this notice when processing changes. Contact the operator using the privacy address above to ask about an update or submit a request.